Time-of-click protection is a security control that re-checks a URL at the moment a user opens it, rather than trusting the link as it looked when the email or message first arrived. This matters because attackers can change or delay malicious destinations, use newly registered domains, or hide links inside QR codes and other containers that are harder to inspect early.
In practice, time-of-click checks are used in email security gateways, secure web proxies, and safe-link systems that rewrite links and validate them again when clicked. This helps defenders catch phishing pages, credential harvesters, and redirected threats that were not obvious during message filtering. It is especially useful against quishing, where the destination may not be visible until the user scans the QR code. Time-of-click protection works best alongside URL rewriting, reputation checks, and phishing-resistant MFA.